General

  • Target

    SeroXen.exe

  • Size

    5MB

  • Sample

    230307-xf12hsag3z

  • MD5

    e3ea239194c4518d7fc8fb69334168ac

  • SHA1

    473f96fa10a95f63463d38a62a0ae8248702fddf

  • SHA256

    1d9af7c6da48e00d634679c064d4ec726c1feb303b2032bd2034c0e5a4626a86

  • SHA512

    7a7a8d5a02b33ab1b20efb0fba4a9d67ff433684badc4a045ac55a76a11aeac958e70c69b0bf919985fd3729be1e5e568b80b497c6c0b961d7f183f1f6cef1a9

  • SSDEEP

    98304:PJMhcHp5ooEAnHRVN07KgHDpS18DqBRe7qxKfT1J+tNY3LU4rI2qo:eg53HRVu7vHDpS1IqBRU7kCs2q

Malware Config

Targets

    • Target

      SeroXen.exe

    • Size

      5MB

    • MD5

      e3ea239194c4518d7fc8fb69334168ac

    • SHA1

      473f96fa10a95f63463d38a62a0ae8248702fddf

    • SHA256

      1d9af7c6da48e00d634679c064d4ec726c1feb303b2032bd2034c0e5a4626a86

    • SHA512

      7a7a8d5a02b33ab1b20efb0fba4a9d67ff433684badc4a045ac55a76a11aeac958e70c69b0bf919985fd3729be1e5e568b80b497c6c0b961d7f183f1f6cef1a9

    • SSDEEP

      98304:PJMhcHp5ooEAnHRVN07KgHDpS18DqBRe7qxKfT1J+tNY3LU4rI2qo:eg53HRVu7vHDpS1IqBRU7kCs2q

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Remote System Discovery

1
T1018

Tasks